One in Four SMEs Faces Very High Cyber Risk and Why Basic Security Gaps Still Drive Attacks
Small and medium-sized enterprises do not need to be reckless to become vulnerable. In many cases, they are simply under-resourced, unevenly protected, and carrying more digital exposure than their internal controls can comfortably support. That is what makes new SME cyber risk data so important. It turns general concern into something more useful: a clearer picture of where smaller firms are exposed and which weaknesses keep appearing.
According to BOTECH’s report on the state of Cybersecurity in SMEs, based on analysis involving almost 1,000 SMEs, one in four SMEs is at very high risk of suffering a cyberattack. The findings also point to systemic weaknesses across access control, ransomware and malware exposure, and web application security.
For SME leaders, this is not just a warning about threat volume. It is evidence that baseline protections are still missing in too many organisations.
Why this finding matters
The phrase “very high risk” can sound broad, but the underlying indicators are highly practical. BOTECH’s analysis suggests that many SMEs are not failing because of one catastrophic gap. They are failing because several smaller weaknesses combine into a much larger attack surface.
The report highlights several notable findings:
* 1 in 4 SMEs is at very high risk of suffering a cyberattack
* 100% of SMEs are exposed in terms of access because of poor privilege management
* less than 6% of companies have low exposure to ransomware and malware
* only 5% audit their web applications or implement specialised web application firewalls
Taken together, those findings suggest a familiar pattern in smaller businesses: partial controls in some areas, serious neglect in others, and very limited containment when an attacker gets in.
Where SMEs are most exposed
The most striking theme in the BOTECH material is not just the presence of risk, but the unevenness of protection. Some businesses have adopted stronger defences, while others remain highly vulnerable in core areas.
Access and privilege management
BOTECH states that 100% of SMEs in the study were exposed in the access stage because of poor privilege management. That is an important finding because attackers do not always need advanced tools if ordinary user access is weakly controlled.
Poor privilege management can include:
* too many users with admin rights
* shared accounts
* weak offboarding of leavers
* excessive access across departments
* limited separation between standard and privileged accounts
For SMEs, this raises a practical issue. Access control is often treated as background admin. In reality, it is one of the most important ways to prevent a minor compromise from becoming a serious incident.
Ransomware and malware resilience
The report also notes that fewer than 6% of companies maintain low exposure to ransomware and malware. That is a sharp reminder that malware resilience is still weak across much of the SME market.
This matters because ransomware risk is not just about being infected. It is about whether the business can:
* stop malicious code from executing
* contain spread across devices and users
* recover cleanly from backups
* continue critical operations during disruption
BOTECH also points out that fewer than 10% have adequate mechanisms to manage the final impact of serious incidents, which implies limited recovery capability when prevention fails.
Web application and external security weakness
Only 5% of SMEs in the study audit their web applications or deploy specialised firewalls for web apps. That is significant because internet-facing systems are often among the first things attacker’s probe.
For SMEs with websites, portals, booking tools, e-commerce systems, or customer logins, external weaknesses can create avoidable entry points. Even when the wider business feels secure internally, exposed applications can quietly widen the attack surface.
What the wider pattern tells us
One of the most useful observations in the BOTECH analysis is that the problem is not simple uniform weakness. It is heterogeneity. Some areas may be reasonably covered, while others are left almost entirely exposed.
That mixed posture is dangerous because it can create false confidence. An SME may have antivirus, backups, and staff training, yet still have:
* weak privilege management
* poor web application security
* no network segmentation
* limited incident response capability
* insufficient visibility into suspicious activity
In practice, attackers only need one neglected route that works.
